Office (OLE) / .XLS malware analysis — malicious · 1cb395ffb3ade917

MALICIOUS

Office (OLE) / .XLS

83.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-05-31

MD5: 37f29f443983fe145220b76bf035065f SHA-1: f48a250c582673fb4d7ae9354cbebce845ae2245 SHA-256: 1cb395ffb3ade917133f564ddbf8ba077432bc8ca2e9bba32f9e329491a2a7d5

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1059.005 Visual Basic

The VBA macro within the Excel file utilizes `CreateObject` to write a VBScript payload to disk at `%APPDATA%\rFECN.vbs`. The script then attempts to execute this payload. The `ShellExecute` and `PowerShell` heuristic firings indicate the potential for command execution, which aligns with the script's behavior. The `Environ()` call suggests the script may be attempting to retrieve environment variables to determine the correct path for writing the payload.

Heuristics 5

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f6a645d2dcabd6539388c8f98e78db98d6c79af5b4c7c0ffaf7ff1c62b2361ff`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1650 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.